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Abstract 



■ A (k, n)-threshold scheme based on two-dimensional memory cellu- 
, lar automata is proposed to share images in a secret way. This method 

C\| | allows to encode an image into n shared images so that only qualified 

■ subsets of k or more shares can recover the secret image, but any k — 1 
. or fewer of them gain no information about the original image. The 

^5 | main characteristics of this new scheme are: each shared image has 

the same size that the original one, and the recovered image is exactly 
the same than the secret image; i.e., there is no loss of resolution. 



Keywords: Cellular automata, Graphic cryptography, Image processing, 
Secret sharing, Threshold scheme. 

1 Introduction 

A secret sharing scheme is a method which allows to share a secret among 
a set of users in such a way that only qualified subsets of these users can 
recover the secret. Consequently, the basic idea in secret sharing schemes is 
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to divide the secret into a fixed number of pieces, called shares or shadows, 
which are distributed among the participants so that the pooled shares of 
certain subsets of users allow the reconstruction of the secret. 

Secret sharing schemes were independently introduced by Shamir (pQ) 
and Blakley ([2]), and their original motivation was to safeguard crypto- 
graphic keys from loss. These schemes also have been widely employed in 
the construction of several types of cryptographic protocols (see, for example, 
jS]) and consequently, they have many applications in different areas such as 
access control, opening a bank vault, opening a safety deposit box, or even 
launching of missiles. 

The basic example of a secret sharing scheme is the (k, n) -threshold scheme 
(or k-out-n scheme) for integers 1 < k < n. In such scheme there exists a 
dealer (or mutually trusted party) and n participants. The dealer computes 
n secret shares Si, < i < n — 1, from an initial secret S, and securely 
distributes them to the users Po, . . . , P n -i, in such a way that any k or more 
users who pool their shares may easily recover the original secret S, but any 
group knowing only k — 1 or fewer shares is unable to recover the secret. 
In other words, each group of k — 1 or fewer shares reveals absolutely no 
information about the secret image. Shamir's scheme, which is based on 
polynomial interpolation, and Blakley's scheme, based on the intersection of 
affine hyperplanes, are examples of (k, n)-threshold schemes. 

Subsequently, Ito et al. (jlj) and Benaloh et al. ( 5J) described a more 
general situation based on the specification of the subsets of participants 
that should be able to determine the secret and the subsets of participants 
that should not. These general secret sharing methods are intimately related 
to the notion of access structure (see |EllZj)- 

For secret sharing schemes, the information rate for a particular partici- 
pant is the bit-size ratio: 



Moreover, the information rate for a secret sharing scheme is the minimum 
rate over all participants. In this sense, an ideal secret sharing scheme is 
a scheme in which the size of the shares given to each participant is equal 
to the size of the secret; consequently, for ideal secret sharing schemes the 
information rate is 1. Moreover, secret sharing schemes satisfying the addi- 
tional property that unqualified subsets can gain absolutely no information 
about the secret are called perfect. For a more detailed description we refer 
the reader to 0013 • 

Usually, the secret to be shared consists in text data, but also images 
can be considered. The first scheme to share images was due to Naor and 
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Shamir (PHI) and it is called visual cryptography. It is based on visual thresh- 
old schemes k of n, i.e., the original image is divided in n shares. Each of 
them is photocopied in a transparency and then, the original image is re- 
covered by superimposing any k transparencies but no less. Moreover, no 
cryptographic protocol is used to recover it. Its main feature is the use of 
human vision properties in order to recover the original image. 

Due to the characteristics of this model, only black & white images were 
suitable to be shared. Nevertheless, in recent years, a wide variety of new 
proposals based on visual cryptography have emerged not only for processing 
gray- level images IT2| IT3]). but also for color images (jTH HH1 EE])- In 
these visual threshold schemes each pixel of the secret image is ciphered by 
means of h subpixels (the pixel expansion) for the n shares; consequently, 
the size of the shared images is much bigger than the original one. Moreover, 
another disadvantage of these schemes is that there is a great contrast loss 
between the secret image and the recovered one. 

Furthermore, other algorithms for sharing images, not based in the visual 
cryptography paradigm, have appeared (see, for example, [TT| ITH]). 

In this paper, we propose a new graphic sharing scheme; i.e., a secret 
sharing scheme for black & white (b&w), gray- level and color images, by 
means of two-dimensional memory cellular automata. The proposed scheme 
is based on cellular automata and the properties of these kind of discrete 
dynamical systems permit us to define an algorithm for sharing secret images. 
In the scheme, the shares obtained for each participant have the same size 
than the secret image and the recovered image is exactly the same than the 
original one, without loss of resolution. These properties are not satisfied by 
any other graphic scheme. 

Roughly speaking, two-dimensional cellular automata are time delay dy- 
namical systems for which time and space are discrete. They consist of a 
collection of a finite two-dimensional array of simple objects, called cells, in- 
teracting locally with each other. Each cell can assume a state such that it 
changes in every time step according to a local rule whose variables are the 
states of some cells at previous time steps. The prize, compared to visual 
cryptography, is that in this new protocol some computations are needed to 
recover the original image. 

The design of cryptographic protocols by means of two-dimensional cellu- 
lar automata is a recent event, and their use are only restricted to symmetric 
ciphers for images (see PTJJ 1201), by the moment. On the other hand, one- 
dimensional cellular automata has been widely used not only for symmetric 
ciphers: stream ciphers (see, for example j2DI221) and block ciphers (|23|). 
but also for asymmetric ciphers ( |24j ) . 

The rest of the paper is organized as follows: In Section 2, some basic 
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concepts regarding memory cellular automata are introduced. In Section 
3, the new secret sharing scheme for b&w, gray-level and color images is 
presented. The security of the proposed scheme is analyzed and proved 
in Section 4. In Section 5 several examples for different classes of images 
and different schemes, are given. Finally, the conclusions of this paper are 
presented in Section 6. 

2 Memory Cellular Automata 

Two-dimensional finite cellular automata (2D-CA for short) are discrete dy- 
namical systems formed by a finite two-dimensional array of r x s identical 
objects called cells, such that each of them can assume a state. The state of 
each cell is an element of the finite state set, S. Throughout this paper we 
will consider S = Z c , where c = 2 b is the number of colors of the image; i.e., 
if the image is a b&w image, then b = 1; for gray- level images the value is 
6 = 8, and if it is a color image, then b = 24. 

The (i,j)-th cell is denoted by and the state of this cell at time 

t is afj G Z c . The 2D-CA evolves deterministically in discrete time steps, 
changing the states of all cells according to a local transition function, 

/: (Z C )"^Z C . 

The updated state of each cell depends on the n variables of the local tran- 
sition function, which are the previous states of a set of cells, including the 
cell itself, and constitute its neighborhood. For 2D-CA there are some classic 
types of neighborhoods, but in this work only the extended Moore neighbor- 
hood will be consider; that is, the neighborhood of the cell (i,j) is formed by 
its nine nearest cells: 

V id = {(i - l,j - 1) , (i - , (i - l, 3 + 1) , - 1) , 
(i,j) , (i,j + 1) , (i + 1,3 + 1,3) , (i + 1, j + 1)} • 

Graphically it can be seen as follows: 
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Consequently the local transition function /: (Z c ) 9 — > Z c is 

a (*+i) _ f ( a (t) a (t) a (t) (t) (f) (t) (0 (t) (t) \ 
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or equivalently, 



4' +1) = / (^?) , 0<«<r-l, 0<j<s-l, 
where C (Z c ) 9 stands for the states of the neighbor cells of at time 



t. The matrix 



,(*) „(*) 
c ■ ■ ■ 



a 00 ' ' ' a 0,s- 



\ a {t) ■■■ a {t) I 

\ "r-l,Q "r-l,s-l / 

is called the configuration at time t of the 2D-CA, and C^ ' is the initial 
configuration of the CA. Moreover, the sequence {C^}o<t<fc is called the 
evolution of order k of the 2D-CA, and C is the set of all possible configura- 
tions of the 2D-CA; consequently \C\ = c r s . 

As the number of cells of the 2D-CA is finite, boundary conditions must 
be considered in order to assure the well-defined dynamics of the CA. In this 
paper, periodic boundary conditions are taken: 

a ij = a ul ^ i = u (mod r) , j = v (mod s) . 

The global function of the CA is a linear transformation, $ : C — > C, that 
yields the configuration at the next time step during the evolution of the CA, 
that is, C( t+1 ^ = $ fC'*'). If $ is bijective then there exists another cellular 
automaton, called its inverse, with global function When such inverse 
cellular automaton exists, the cellular automaton is called reversible and the 
evolution backwards is possible ([25]). 

Let us consider the set of 2D-CA whose local transition functions are of 
the following form: 



(t+i) _ \ „(*) 

a ij — 



E ^41^ (mode) 

a,/Je{-l,0,l} 



with 0<i<r — 1, < j < s — 1, and A Q/ 3 G Z 2 . They are called 2D-Moore 
linear cellular automata (2D-LCA). As there are 9 cells in the extended 
Moore neighborhood, then there exist 2 9 = 512 two-dimensional LCA, and 
every one of them can be conveniently specified by a decimal integer called 
the rule number: w, which is defined as follows: 

w = A_i,_i2 8 + A_!,o2 7 + A_i,i2 6 + A ,-i2 5 + A , 2 4 
+ -Vi^ 3 + -^i,-i2 2 + Ai i o2 1 + Ai j i2°, 

where < w < 511. 
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The standard paradigm for CA considers that the state of every cell at 
time t + 1 depends on the state of some cells (its neighborhood) at time t. 
Nevertheless, one can consider CA for which the state of every cell at time 
t + 1 not only depends on the states of some cells at time t, but also on 
the states of (possible) other different groups of cells at times t — 1, t — 2, 
etc. This is the basic idea of memory cellular automata, MCA for short, 
(see [26J). In this paper, we consider a particular type of MCA called k-th 
order linear MCA (LMCA for short) for which the local transition function 
is of the following form: 



fe-i 

(t+i) 



J2f^{ v t m) ) ( modc )> ( 2 ) 



m=0 



with < i < r — 1, < j < s — 1, and where fi, 1 < I < k, are the local 
transition functions of k particular 2D-LCA. 

Note that the initial configuration of a 2D-LMCA is formed by k com- 
ponents, C^°\ . . . , C^ -1 ^, in order to initialize the evolution of the MCA of 
order k. 

A particular type of reversible MCA with local transition function @ is 
characterized by means of the following result. 

Proposition 1 If the global function defining the 2D-CA with local transi- 
tion function fk is the identity, i.e., if 



(t-k+i)\ _ (t-k+i) 



then the LMCA given by (j2J) is a 2D-reversible MCA, whose inverse CA is 
another LMCA with local transition function: 



(<+1) " - E h- m -, (Vt m) ) + (-od c) , (3) 



m=0 

forO < i < r- I, < j < s- 1. 



Proof. Suppose that {C^} t >o is the evolution of the LMCA given by (j2J), 
where 

/ a [t) ■■■ a (t) \ 

u 00 U 0,s-1 



\ a {t) ■■■ a (t) I 

\ "r-1,0 u r-l,s-l / 
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is the configuration at time t, and let {C^} t >o be the evolution of the LMCA 
given by ®, where: 

/ a {t) ■■■ ~a {t) \ 

I a 00 a 0,s-l 

C (t) =\ : : 

V a {t) ■■■ ~a {t) ) 

\ a r-l,0 u r-l,s-l / 

The proof ends if we show that = C^+V when = C( t+1 \ = 

. . ., = C^~ k+2 \ for every t. Consequently, by simply applying (JBJ) 
we obtain: 

a?" " = - A-i (vf ) - (if- 1 ') - ... - /, (i£ ») + S«" (mod c) , (4) 

for < i < r - 1, < j < s - 1. As (7( m ) = C^-"^ 2 ) with 1 < m < k, then 
= m+2 ' ) with 1 < m < k. As a consequence, taking into account 

the value of C^ +1 ' given by (J2J), the equation (JH) yields: 

= (^" +2) ) -•••-h + ag +1) (mode) 

+ /i (^f) + • • • + A-i (^~ fc+2) ) + «r fc+1) (mode) 
= (mod c) , 

for every < i < r — 1, < j < s — 1, thus = C^" fc+1 ) and we 

conclude. ■ 



3 A new graphic secret sharing scheme based 
on MCA 

In this section we propose a new graphic secret sharing scheme, specifically a 
graphic (k, n)-threshold scheme, based on memory cellular automata, in order 
to apply it to images. Basically, it consists of considering the secret image 
as the first component of the initial configuration for a 2D reversible LMCA 
of order k, and the rest of k — 1 components of the initial configuration are 
k—1 random matrices. The shares to be distributed among the n participants 
are n consecutive configurations of the evolution of the LMCA. In the next 
subsections, the scheme is more detailed. 
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3.1 The representation of an image as a matrix 

An image I denned by c colors and rxs pixels, pij, with 1 < % < r, 1 < j < s, 
can be considered as a matrix M with coefficients in Z c , as follows: 

1. If I is a b&w image, then M is an r x s matrix whose (i, j)-th coefficient 
is 1 (resp. 0) if the pixel is black (resp. white); i.e., the coefficients 
of M are in Z 2 (c = 2, and hence 6 = 1). 

2. If I is a gray-level image, then the RGB code of each pixel, pij, is given 
by the three-dimensional vector (R,G,B), where < R, G, B < 255 
and R = G = B. Consequently, each pixel can be defined by a number 
< R < 255. Hence, M is an r x s matrix with coefficients in Z 2 s. 

3. Finally, if / is a color image, then each pixel is given by 24 bits (8 bits 
representing each basic color: red, green and blue). As a consequence 
M is an r x s matrix with coefficients in Z 2 24. 

3.2 The graphic sharing scheme 

As it is mentioned, the secret sharing scheme proposed is a (k, n)-threshold 
scheme based on the use of a 2D-reversible LMCA. The protocol contains 
three phases: The setup phase, the sharing phase and the recovery phase. 

3.2.1 The setup phase 

This first phase is given by the following steps: 

1. The dealer generates a sequence of k — 1 random integers numbers: 

{wi,...,w k -i} (5) 

such that < wi < 511 with 1 < I < k — 1. These numbers stand 
for the rule numbers of the 2D-LCA constituting the memory cellular 
automata. 

2. The dealer constructs the 2D-LMCA with local transition function: 

«g +1) = U (V,?) + • • • + {Vt k+i) ) + «r fc+1) (mode) , (6) 

where f W{ : (Z c ) 9 — > Z c , and < i < r — 1, < j < s — 1. The set 
of random numbers given in © should be securely distributed to the 
participants if the dealer's role is limited to elaborate the shares, and 
his help is not necessary to recover the secret image. 
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3. The matrix representing the secret image to be shared is considered 
as the first component of the initial configuration, = M. More- 
over, to complete the initial configuration, the dealer generates k — 1 
random components: . . . , C^- k ~ l \ by means of a cryptographic se- 
cure pseudorandom number generator (see [SI Section 5.5]), in order to 
avoid an attack to the scheme by supposing the values of these k — 1 
matrices. These k — 1 configurations must be destroyed after generating 
the shares. 



3.2.2 The sharing phase 

1. The dealer chooses a integer number m, such that m > k in order to 
avoid possible overlaps between the initial conditions and the shares. 
(Note that the number of iterations increases with m, so this number 
would not be much bigger than k.) 

2. Starting from the initial configurations C^°\ . . . , C^ k ~ l \ the dealer com- 
putes the (m + n — l)-th order evolution of the 2D-LMCA: 

_f£<(0) ^j(k-l) £j{k) (j{ m ) £i(m+n— 1) \ 



3. The shares to be distributed among the n participants, P > • • • > P n -i, are 
the last n configurations computed: S = C^ m \ . . . , if> n _i = (7( m +™- 1 ). 
Moreover, each participant receives the set of random numbers gener- 
ated by the dealer in the step 1 of the setup phase, in order to construct 
the inverse function of the local transition function given by formula (p)|) . 
In this way, each participant knows how to recover the original image, 
without the cooperation of the dealer. 



3.2.3 The recovery phase 

To recover the secret image, any consecutive k (of n) shared images are 
needed, but no less. The following steps define this phase. 

1. To recover the secret, C^°\ a set of k consecutive shares of the form 

S a = C {m+a) , . . . , S a+k „! = C {m+a+k -^ ] , < a < n - k, 
is needed. 

2. Taking S = c( m+a+k ~ 1 \ . . . , S k ^ = C^ m+a \ and iterating m+a+k-1 
times the inverse LMCA, the secret initial configuration (the original 
image), C^, is obtained. 
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Note that the recovered image is exactly the same than the original one 
because the LMCA is reversible. This property of the proposed scheme is not 
verified by any other graphic sharing scheme. Moreover, as every participant 
knows the local transition function, they do not need the collaboration of the 
dealer for recovering the original image. 

4 Analysis of the security of the scheme 

In this section, the security of the proposed graphic sharing scheme is ana- 
lyzed. First of all, note that from the formula (JIJ, the information rate of 
each participant of this scheme is 1, and consequently, the information rate 
for this secret sharing scheme is also 1. Furthermore, the scheme proposed 
is ideal. It is also perfect, as it is proved in the following 

Proposition 2 Let us consider the LMCA given by the local transition func- 
tion (J2J). If one configuration of the form C^ - *-*, < i < k — 1, is unknown, 
then no information about the configuration C ,< -* +1 - ) can be obtained. 

Proof. Note that the evolution of the LMCA with local transition func- 
tion (0) can be expressed in terms of global functions as follows: 



C (t+i) = $l ( C (*)) + . . . + $fc l (cf(t-fc+2)) + $fc ( mod c ) , ( 7 ) 



where $j stands for the global function of the 2D-LCA with transition func- 
tion fi. Now, without loss of generality, we can assume that the unknown 
configuration is C^~ k+1 \ Then the formula (jJJ) yields: 



where U = (liy) is a known matrix, and V = (vy) is the unknown matrix 
&k (C^~ k+1 >), where < i < r — 1, < j < s — 1. Both matrices have 
coefficients in Z c . As a consequence, the following linear system holds: 



which is formed by r • s equations with 2r • s unknowns. Consequently, it can 
not be solved and, obviously, no information about the configuration 



C (t+i) = u + V (mode) 




+ Vij (mod c), < i < r — 1 , < j < s — 1 




is obtained. ■ 
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Remark that a similar result holds if the number of unknown configura- 
tions is greater than one. As a consequence, for the secret sharing scheme 
proposed it is impossible to recover the secret image from k — 1 (or less) 
shares. 

Furthermore, it is assumed that each participant knows the local transi- 
tion function, but this knowledge does not suppose a weakness of the scheme 
and it permits to recover the secret image without the collaboration of the 
dealer. 

5 An example 

In this section, an example for a (k, n)-threshold scheme will be presented. 
The random matrices (configurations) C^ 2 \ . . . , C^ 1 ^, for the step 3 in 
the setup phase have been generated by using the BBS pseudorandom bit 
generator (|2Zj)- This generator is a cryptographically secure pseudorandom 
bit generator and it is defined by iterating the function x 2 (modn), where 
n = p-q is the product of two large prime numbers, each of them congruent to 
3 modulo 4. In other words, the BBS generator produces a sequence of bits by 
taking the least significant bit of the sequence defined by Xj+i = x 2 (modn), 
i > 0, where x is the seed of the generator. The conditions for choosing 
the modulus n and the seed Xq, in order to obtain orbits of maximal periods 
have been established in [2%] . 

In the practical implementation of the proposed scheme for the following 
example, we have decided to obtain shared images of the same type than the 
original one, that is, as the original image is a gray-level image, the shares also 
will be gray-level images. An easier implementation could determine shares 
with 2 24 colors, in all cases, i.e., without taking into account the number of 
colors of the secret image. 

The image used in the following example has 181 x 157 pixels and 249 
gray- levels (see Figure HJ). Moreover, the local function used is defined by 
means of the number W\ = 232, and the parameters are: 

k — 3, n — 5, m — 3. 

In this way, 5 iterations for the CA have been needed in order to obtain the 
following images: 

C (0) j C (l) ? C {2) Sq = C (3) Si = C {4) ^ = C (5) ^ ^ = C {6) ^ ^ = C (7) 

The five shares are shown as images in Figures El El IH and|Hl respectively. 

For this example we have used the shares S2, S3 and S4 to recover, after 
5 iterations, the original image (see Figure EJ. 
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6 Conclusions 



In this paper a new graphic (k, n)-threshold scheme for sharing secret b&w, 
gray-level and color images is presented. The scheme is based on two- 
dimensional reversible linear memory cellular automata. The two main char- 
acteristics of this new scheme, which are not satisfied by any previous pro- 
posed graphic schemes, are: (1) The size of each shared image is exactly the 
same than the size of the secret image to be shared, and (2) There is no loss 
of resolution in the recovery secret image. 

Moreover, the security of the scheme has been analyzed and it has been 
proved that in order to obtain the original image it is necessary to join, at 
least, k shares. If k — 1 or less shares are pooled, no information of the secret 
image is obtained. 
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Figure captions 




Figure 1: Secret image 




Figure 2: First share 
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Figure 3: Second share 




Figure 4: Third share 
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Figure 5: Fourth share 



Figure 6: Fifth share 
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